Not rated
CVE-2021-25040 The Booking Calendar WordPress plugin before 8.9.2 does not sanitise and escape the booking_type parameter before…
Description
The Booking Calendar WordPress plugin before 8.9.2 does not sanitise and escape the booking_type parameter before outputting it back in an admin page, leading to a Reflected Cross-Site Scripting
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| Booking Calendar 8.9 | earliest → < 8.9.2 | 8.9.2 |
Other CVEs of Booking Calendar
The 4 CVEs of Booking Calendar →
CVE-2026-105195
The Booking Calendar WordPress plugin before 11.8.3 does not adequately restrict which options a lower-privileged user…
2.7
Low
CVE-2026-105193
The Booking Calendar WordPress plugin before 11.8 does not generate its per-booking access hashes with sufficient…
4.8
Medium
CVE-2023-4620
The Booking Calendar WordPress plugin before 9.7.3.1 does not sanitize and escape some of its booking from data,…
6.1
Medium